The vulnerability is a stored cross‑site scripting flaw in the Statistics Graph card of Home Assistant. Prior to the 2026.7.0 release the card interpolated unescaped entity names into the HTML of an ECharts tooltip. An attacker who can supply or modify a default entity name—either by authenticating to the system or by controlling an integration that introduces a malicious name—can cause arbitrary JavaScript to run in the browser of any user who hovers over the chart. This permits execution of client‑side code in the victim’s session, which could be used for phishing, credential theft, or other malicious actions, although the CVE description does not explicitly state these outcomes.

The flaw exists in the Home Assistant core component (home‑assistant:core). All releases prior to 2026.7.0 are affected. The Statistics Graph card, when rendered with the default line chart configuration (Mean, State, Sum, Change), is vulnerable; bar charts are not.

The CVSS score of 9.3 signifies a high severity level. EPSS data is not available, so the current likelihood of exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to have a normal user account or to control an integration that can inject a malicious default entity name. Once a user hovers over the chart, the script executes in that user’s browser, enabling client‑side code execution. No network‑level attack is required, so the attack path is local or limited to the web interface.